1. Who this policy covers
Momentale provides private shared-event albums, long-term memories, and the 321 photo booth and AI design tools. This policy covers account holders, business members, Collection members, invitees, event guests, and visitors to our website.
For account, billing, security, product analytics, and service-operation data, Momentale determines why and how the data is used. For guest content and event information submitted to a host's album, the host or relevant business may also determine the purpose of collection. Guests should contact the host for event-specific questions; Momentale will still accept and route privacy requests.
2. Data we collect
Accounts and organizations
Name, email address, password hash, verification and security state, session activity, plan and usage information, business membership, venues, and support history.
Events, invitations, and guests
Event names, dates, venues, covers, themes, guest-link settings, guest display names, personal invitation names and email addresses, RSVP status, attendee names, dietary and accessibility requirements, custom RSVP answers, notification preferences, and email delivery type, state, attempts, and timestamps.
Memories and interactions
Photos, videos, audio and voice messages, written messages, captions, transcripts, capture dates, favorites, reports, missions, quizzes, Stories, slideshows, and contributor attribution. Collection photo uploads may contain precise GPS coordinates and resolved place information.
Technical, analytics, and billing
IP-derived security information, browser/device characteristics, request and error diagnostics, consented product-usage events, referral and campaign data, Stripe customer/subscription/payment references, invoice and refund state. Momentale does not receive complete payment-card numbers from Stripe.
3. Why we use data
- Provide, secure, personalize, and support albums, invitations, Collections, photo booths, requested AI designs, uploads, presentations, and billing.
- Authenticate users and guest sessions, enforce permissions, prevent abuse, moderate reports, and protect private assets.
- Process payments, subscriptions, refunds, taxes, vouchers, and accounting records.
- At a host's request, send personal invitations, RSVP and event reminders, album-open and Story-ready notices, as well as verification, password-reset, collaboration, service, and legally required messages.
- Improve reliability and product experience using consented browser analytics and limited server-side operational measurements.
- Meet legal obligations and establish, exercise, or defend legal claims.
4. Legal bases
Depending on the context, processing is necessary to perform our contract with an account holder, based on a legitimate interest in providing a secure and reliable private service, required by law, or based on consent. Browser product analytics are optional and require a positive choice. You may withdraw analytics consent through Cookie choices.
Hosts should have an appropriate basis and permission to invite people and collect event content, RSVP details, accessibility information, dietary information, and custom responses. Do not request sensitive information unless it is necessary for the event.
6. AI designs, prompts, and reference images
When you request an AI frame, camera prop, or subject sticker in 321, we process your description, generation settings, any attached image, and the resulting artwork. OpenAI receives the description and instructions needed to prepare and generate your design. For frames and props, an attached reference image is sent to the image model when your description asks to use it; the prompt-preparation model interprets that instruction. Subject-sticker requests send the source photo to isolate the requested subject.
We store the original and enhanced prompts, model and quality settings, generation status, credit activity, and relevant usage information. After a successful generation, you can inspect the prompts, settings, and attached image in your design details. An attachment is saved even if it was not used to generate the design. Saved designs and their reference images remain in your private library records while you keep the generated asset. Sharing or using the artwork does not by itself publish its prompts or reference image.
Authorised Superadmins can inspect generation results, prompts, references, and settings for support, recovery, and quality review. Rejected artwork is viewable only in Superadmin, expires after seven days, and is then removed by scheduled cleanup. Temporary processing files and references for failed or cancelled jobs are also eligible for cleanup seven days after completion. Unresolved jobs retain the files needed for recovery. These cleanup periods describe Momentale’s storage, not the provider’s retention.
Deleting a generated asset removes its saved reference image. Prompts and non-image generation, credit, and purchase records may remain in your account history and data export; deleting the image alone does not erase that history. Account deletion and privacy requests follow the controls below, including applicable billing and audit retention. Only upload images you have permission to use, and avoid including unnecessary personal or sensitive information in prompts.
7. International transfers
Providers may process data outside your country. Where required, Momentale uses an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism. Current information about relevant provider and hosting locations is available by submitting a privacy request.
8. Retention and deletion
Album contribution, original-download, gallery, and deletion dates come from the selected plan and are displayed in the host's Privacy & data workspace. Guest access ordinarily renews for 90 days after meaningful activity, no more than once per hour, and ends no later than 12 months after first join.
Consented raw browser analytics are retained for 90 days. Operational error occurrences are retained for 30 days and health samples for 90 days. Together keeps room timestamps, connection type, approximate duration and reliability counters for up to 90 days, without names, network addresses, credentials or media in those summaries. Together photo-round, download and share counts require optional analytics consent. Aggregated statistics may remain when they no longer directly identify a person.
Deleting an album, Collection, media item, or account removes its active stored content. Billing, fraud-prevention, audit, dispute, and legal records may remain for the period required by law, with direct account identity removed where possible. Backup copies may persist for a limited backup cycle and are not restored except for disaster recovery.
9. Your rights and choices
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent. Account holders can download a structured data export and delete eligible personal accounts directly under Privacy & data. Anyone may use the privacy request form.
We may need to verify identity before releasing or deleting information. If your request concerns an event guest contribution, include the event title, approximate date, host name, guest display name, and enough context to locate it without sending unnecessary sensitive data.
10. Children and family Collections
Momentale is not directed to children creating their own accounts. Adults creating child-growth or family Collections are responsible for having authority to upload, invite members, and choose location visibility. Keep Collection membership limited to trusted people, and remove embedded location data or keep visibility Hosts only when precise location is unnecessary.
11. Security
Momentale uses password rules, email verification, rate limits, role-based authorization, hashed or encrypted link credentials, HttpOnly session cookies, protected non-public storage, expiring signed asset links, moderation controls, and audit and operational safeguards. No online service can promise absolute security; report suspected access immediately.
12. Contact and complaints
Email privacy@momentale.app or submit a privacy request. We aim to acknowledge requests promptly and ordinarily target completion within 30 days, subject to identity verification and legally permitted extensions.
You may also complain to the data-protection authority in your country. In the Netherlands, this is the Autoriteit Persoonsgegevens.
13. Changes to this policy
We will update the effective date when this policy changes. Material changes affecting registered users will be communicated through the service or by email where appropriate.